Vulnerability in Dadrus Heimdall
CVE-2026-42273
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can resu…
EPSS: 0.001 (17.7th percentile) — read the EPSS interpretation.
Affected products
- Dadrus Heimdall — versions < 0.17.14
Weakness classification (CWE)
References
- https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37 (x_refsource_CONFIRM)
- https://github.com/dadrus/heimdall/pull/3208 (x_refsource_MISC)
- https://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943 (x_refsource_MISC)
- https://github.com/dadrus/heimdall/releases/tag/v0.17.14 (x_refsource_MISC)